Dependabot: group PRs; security-only for app dependencies (#18)

Grouping collapses each ecosystem's updates into a single PR instead of
one per package. `applies-to` matters: a group covers version updates
unless told otherwise, so the security-only ecosystems spell it out.

npm and uv are security-only via open-pull-requests-limit: 0, which
switches off routine version-bump PRs while security updates — exempt
from that limit — keep coming. That stops repeats of the setuptools
constraint bumps that had to be fixed upstream anyway.

GitHub Actions keeps its routine bumps: advisories for actions are rare,
so making it security-only would effectively freeze action versions.


Claude-Session: https://claude.ai/code/session_011texLkDBELWbXsBf6San3M

Co-authored-by: Claude <noreply@anthropic.com>

Author: albertotb

.github/dependabot.yml

@@ -1,14 +1,30 @@
 version: 2
+# Grouping keeps each ecosystem's updates to a single PR instead of one per
+# package. Note `applies-to`: a group covers version updates unless told
+# otherwise, so security-only ecosystems need it spelled out.
 updates:
+  # Actions keep their routine bumps — advisories for them are rare, so waiting
+  # for one would freeze the versions.
   - package-ecosystem: github-actions
     directory: /
     schedule:
       interval: weekly
+    groups:
+      actions:
+        patterns: ["*"]
 
+  # Application dependencies: security updates only. `open-pull-requests-limit: 0`
+  # switches off routine version-bump PRs; security updates ignore that limit and
+  # keep coming.
   - package-ecosystem: npm
     directory: /frontend
     schedule:
       interval: weekly
+    open-pull-requests-limit: 0
+    groups:
+      frontend-security:
+        applies-to: security-updates
+        patterns: ["*"]
 
   # The backend package lives in a subdirectory, so it needs its own entry
   # (`uv.lock` there is already picked up by the dependency graph, but an entry
@@ -17,3 +33,8 @@ updates:
     directory: /backend
     schedule:
       interval: weekly
+    open-pull-requests-limit: 0
+    groups:
+      backend-security:
+        applies-to: security-updates
+        patterns: ["*"]